Here are 10 of the biggest zero-day attacks of 2023 in chronological order.
Zero-day attacks started strong in 2023 with CVE-2023-0669, a pre-authentication command injection vulnerability in Fortra's GoAnywhere managed file transfer product.
Cybersecurity reporter Brian Krebs first reported the flaw on Feb. 2; Fortra had issued a private security advisory for CVE-2023-0669 the day before to authenticated customers.
The Fortra GoAnywhere flaw was just the first MFT zero day that led to several more attacks.
The vendor said it discovered the flaw on May 19th and issued a patch to all appliances the following day.
While the initial advisory contained few details about the vulnerability, more information about the flaw and related attacks came to light the next week.
The FBI later warned in August that suspected Chinese nation-state hackers continued to exploit the zero-day flaw.
Another MFT zero-day vulnerability appeared on May 31 when Progress Software disclosed and patched an SQL injection flaw, tracked as CVE-2023-34362, in its MoveIt Transfer software.
The following day, Rapid7 reported exploitation of the zero-day flaw, but the situation rapidly worsened just a few days later.
On June 4, Microsoft Threat Intelligence Center attributed exploitation of the MoveIt Transfer flaw to a threat actor it tracks as Lace Tempest, which is associated with the Clop ransomware gang.
Clop threat actors exploited the zero-day flaw in Fortra's GoAnywhere MFT product earlier in the year.
Mandiant, which discovered the zero-day flaw, reported on the same day of the disclosure that a Chinese cyber espionage threat group it identifies as UNC3886 exploited the VMware Tools vulnerability.
There were plenty of zero-day flaws in Microsoft products in 2023, but one of the most significant was CVE-2023-36884, a remote code execution vulnerability in Windows Search.
Disclosed in October, the flaw also lets attackers bypass MotW protections.
Tracked as CVE-2023-4863, the zero-day flaw lets a remote attacker perform an out-of-bounds memory write through a malicious WebP image.
The vulnerabilities include CVE-2023-41992, an elevation of privilege flaw in the OSes' kernel; CVE-2023-41991, a security flaw that let attackers bypass signature validations; and CVE-2023-41993, a flaw in Apple's WebKit browser engine that can lead to arbitrary code execution.
Tracked as CVE-2023-22515, the flaw was initially described as an elevation of privilege vulnerability that affected the self-managed versions of the Confluence workspace suite.
The next day, Atlassian assigned the zero-day flaw a CVSS score of 10 and revised the description of the flaw.
Exploitation of the zero-day flaw continued in November.
A remote attacker could exploit the flaw and gain the highest level of privileged access to devices running the software.
This Cyber News was published on www.techtarget.com. Publication date: Thu, 04 Jan 2024 20:43:04 +0000